CVE-2026-54613

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5.

• CWE-22

• https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.5
• https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8
• https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8

Published

Sep 17, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54606SunEditor is a lightweight and powerful WYSIWYG editor in va…8.5
• CVE-2026-54607FastGPT is a knowledge-based AI application platform. Prior …7.7
• CVE-2026-54608MythicalDash is a Pterodactyl client area. In 3.5.4-aurora a…7.1
• CVE-2026-54609QTI Neon is a minimal, game-agnostic, relay-based UDP multip…8.6
• CVE-2026-54611InstantCMS is a free and open source content management syst…5.5
• CVE-2026-54612Vvveb is a powerful and easy to use CMS with page builder to…8.8
• CVE-2026-54614DebugKit provides a debugging toolbar for CakePHP applicatio…4.3
• CVE-2026-54616NanaZip is the 7-Zip derivative intended for the modern Wind…7.1
• CVE-2026-54617GravitLauncher is an open-source Minecraft launcher based on…9.8
• CVE-2026-54618Obsidian Web MCP is a secure remote MCP server for Obsidian …9.4
• CVE-2026-54619sqlite3 provides Ruby bindings for the SQLite3 embedded data…2
• CVE-2026-5462A vulnerability was identified in Wahoo Fitness SYSTM App up…3.3